Authentication

Every request to the ASF Fundraiser API is authenticated with two values that are issued together when ASF onboards your partner platform. These are required on every call — omitting them will return 401 Unauthorized.

What you need

Credential	Header	Treated as
client_id	client_id	Public-ish, but rotate if leaked
client_secret	client_secret	Confidential

You’ll also send an X-Correlation-ID header on every request — a fresh UUID per outbound call. ASF uses it to trace requests through the platform. Not authenticating, but mandatory; missing correlation IDs are rejected at the gateway.

Getting credentials

Credentials are issued by the ASF team, not self-service. To request a set:

1. Email info@asf.org.au with your platform name and which sports or fundraising accounts you expect to enable fundraising for.
2. ASF invites you to the Mulesoft Anypoint Platform
3. Accept the invitation and request access to an API Instance
4. The request is automatically approved and provides you with two values: client_id, and client_secret.
5. Store the two values as secrets in your platform. Never commit them to source control. Never log them.

Four environments are available:

Environment	Base URL	Use for
Pre-production (SIT)	https://sit.api.asf.org.au/fundraisers/api/v1	Integration testing. Donations created here are not real.
Pre-production (UAT)	https://uat.api.asf.org.au/fundraisers/api/v1	Acceptance testing. Donations created here are not real.
Pre-production (Staging)	https://preprod.api.asf.org.au/fundraisers/api/v1	Staging. Donations created here are not real.
Production	https://api.asf.org.au/fundraisers/api/v1	Live endpoints.

Credentials are environment-specific — pre-prod credentials will not work in production.

Putting it together

A complete authenticated request looks like this:

curl

curl -i \
  -X GET 'https://sit.api.asf.org.au/fundraisers/api/v1/fundraisers?channel=XYZ%20Platform&id=ASF123456' \
  -H "client_id: $ASF_CLIENT_ID" \
  -H "client_secret: $ASF_CLIENT_SECRET" \
  -H "X-Correlation-ID: $(uuidgen)"

Node.js

import { randomUUID } from 'node:crypto';

const basic = Buffer
  .from(`${process.env.ASF_BASIC_USER}:${process.env.ASF_BASIC_PASS}`)
  .toString('base64');

const res = await fetch(
  'https://sit.api.asf.org.au/fundraisers/api/v1/fundraisers' +
    '?channel=XYZ%20Platform&id=ASF123456',
  {
    method: 'GET',
    headers: {
      client_id: process.env.ASF_CLIENT_ID,
      client_secret: process.env.ASF_CLIENT_SECRET,
      'X-Correlation-ID': randomUUID(),
    },
  },
);

Use placeholders in code samples

Every code sample you publish (internal wiki, support tickets, GitHub) should reference environment variables or placeholder names — never literal credential values. ASF rotates partner credentials on suspicion of leakage and will require you to update both environments on short notice if a leak is reported.

What can go wrong

401 Unauthorized

The client_id or client_secret are not valid or the client does not have access.

Returned when any of the two credential values is missing or wrong. ASF intentionally does not say which one — that’s by design, to avoid leaking which value a probing attacker got right.

Checklist:

• Both client_id and client_secret headers present?
• Credentials match the environment you’re hitting? (preprod keys won’t work on api.asf.org.au.)
• Have you rotated recently and forgotten to update one of the values?

429 Too Many Requests

The client used all of its request quota for the current period.

Partners have per-client quotas. The window and limit are set per-partner at onboarding. Respect Retry-After if present. Implement exponential backoff with jitter — don’t burst on quota reset.

500 / 503

Server-side errors. 500 returns error.code: FUNDRAISER:UNKNOWN; 503 is the gateway saying upstream is temporarily unavailable. Both are retryable with backoff. If 500s persist, send the correlationId you generated to info@asf.org.au — ASF can trace it.

Rotating credentials

ASF rotates partner credentials on a schedule (currently annually) and on demand if a leak is reported. Rotation steps:

1. ASF sends the new credential bundle via the agreed secure channel.
2. You have a 14-day overlap window during which both old and new credentials are accepted.
3. Roll the new values into your platform’s secret manager, redeploy, verify, and confirm to ASF.
4. Old credentials are revoked at the end of the overlap window.

If you suspect a leak, contact info@asf.org.au immediately — emergency rotations skip the overlap and revoke old credentials inside an hour.

Next steps

• Get started with a five-minute integration walk-through.
• See the Online Store or Registration Platform end-to-end examples.
• Browse every endpoint in the API Reference.